Host
- Philippa Lamb
Guests
- Polly Tsang, Senior Financial Services Regulatory Manager, ICAEW
- Jessica Caws, Co-Head of Financial Services at Birketts LLP
- Shermeen Kazmi, Partner, Grant Thornton
Producer
- Natalie Chisholm
Transcript
Philippa Lamb: Welcome to behind the numbers. Today we're looking at a particularly murky aspect of crypto asset custody. Crypto asset custody emerged as a potential threat when the digital currency platform Celsius network collapsed in 2022. Celsius' business model seemed simple: customers deposited their cryptocurrency, Bitcoin, Ethereum and the like, in return for a high percentage yield. Now Celsius offered loans too, if customers pledged their crypto as security, it claimed to be a safe place to trade. It wasn't. It was entirely unregulated, and when it filed for bankruptcy, many customers discovered they had unwittingly granted custody of their assets to Celsius. Since then, international regulators, including the FCA, have been looking at custody rules and wider regulation around digital assets. But are they on the right track?
Polly Tsang: It's crypto's Lehman Brothers moment, but with no bailout, no consumer protections, people were left holding back.
Jessica Caws: Consumers were really drawn to this Earn product, which is this, you know, they were sort of promising this yield of 17/18%, but buried in the terms and conditions is that if you wanted to sort of acquire this Earn product, you needed to transfer your crypto assets over.
Shermeen Kazmi: You've got to look at the consumer protection in light of the underlying risks that these assets bring and how they impact the consumer confidence.
PL: With me to talk about the lessons from Celsius, I have Grant Thornton partners, Shermeen Kazmi and Jessica Caws, Co-Head of Financial Services at Birketts LLP, and Polly Tsang, Senior Financial Services Regulatory Manager here at ICAEW, who has been on the podcast before shedding light on crypto, is back with us. Welcome everyone.
PT: Thank you very much for having us.
JC & SK: Thank you.
PL: Polly, give us a bit more insight into Celsius investors. They flocked, didn't they? They were offering high returns.
PT: Oh, they did. So, bit of background: Celsius was the biggest crypto lender, probably in 2022. It had 1.7 million customers, it had $12 billion of assets under management. It was basically a bank, but without the capital requirements, without the deposit protections, without a regulator looking over its shoulder, and you're absolutely right. People flocked to it because it was the perfect storm. It was post covid. Liquidity was sloshing around, interest rates were low, people were looking for returns. And lo and behold, Celsius was there to offer you 17% if you're willing to park your money with them. Now in the background, how were they achieving this? They were re-hypothecating, aggressively re-hypothecating customers assets to hedge funds to other risky crypto projects. That's how they were chasing their yield. You're probably thinking, "hmm, this is not sustainable. They got away with it because the markets supported it."
PL: Rose up to meet them.
PT: Exactly. But in early 2022 the markets, the crypto markets, went down, and they couldn't chase that yield. Customers wanted to take their money out, and in June 2022 they had to freeze all customer withdrawals. If this sounds familiar, it is because it is. This is a classic bank run, except like it's cryptos Lehman Brothers moment, but with no bailout, no consumer protections. People were left holding the bag.
PL: As you say, they weren't a bank. And the CEO, Alex Mashinsky, he made a big point about this, didn't he? He was like "unbank yourself". You know, he was the guy running around in T-Shirts. There was a lot of razzmatazz, wasn't there, about the whole thing? And there they were. Jess, how exactly were customers misled, though? I mean, we understood about the fallout. How do they get there?
JC: I think it's useful context that Polly is saying that there was that filing for bankruptcy in 2022 and from there, there were loads of sort of parallel actions, civil and criminal. And I think this year, even the former CEO finally was imprisoned for fraud related offences. I think he was sort of sentenced to 12 years in prison. But when we're talking about misleading customers, it's quite good to look at the Federal Trade Commission findings, because they're the sort of US body that focuses on consumer protection. And they concluded that, yes, Celsius had been misleading customers, mostly around sort of social media, and the posts that were being made on social media. You know, these claims that Celsius was less risky than banks, that you could withdraw your money at any time that they had insurance policies in relation to deposits.
PL: So they directly misled people?
JC: Yeah, absolutely. And even days before the bankruptcy filings, my understanding is that, you know, the founders were on social media saying "invest with us. It's safe. It's much less risky than a bank." And, yeah, I think consumers are really drawn to this earn product, which is this, you know, they were sort of promising this yield of 17/18%, but buried in the terms and conditions is that if you wanted to sort of acquire this Earn product, you needed to transfer your crypto assets over. And I mean, it was buried in the terms and conditions, in the sense that, I think when you sign up to something online, often you might sort of scroll, scroll, scroll and agree. And this was very much sort of that, that type of situation. So consumers had no idea they transferred title to their crypto assets. And based on these statements made on social media, they thought their assets were safe. And then on bankruptcy, the title had been transferred, and they had an unsecured claim against the Celsius.
PL: So they were right at the bottom of the heap?
JC: Yeah, absolutely, this was the Earn products in particular. So, yes, the FTC eventually banned Celsius from handling consumer funds, and they charge the key people for misleading consumers.
PL: Shermeen, it's a sorry tale, isn't it? and as Polly and Jess say, not a new tale. A lot of customers have got their money back now, is that right?
SK: Well, it's known that a certain percentage of customers have certainly got their money back. But as with any of these insolvencies, this happened in 2022 and between 2022 and 2024 there's been a lot of legal proceedings uncovering at which level do the customers actually sit. Jess mentioned about the earned product customers. Were they very different to the customers who were not engaged in certain products with Celsius? So it does actually come back to the terms and conditions and how they were engaged with Celsius and what percentage of money they got back. And it's quite interesting, because at that time that Celsius went under, there was about $4.7 billion owed at the time of collapse with a shortfall of about $1.2 billion. So two years forward, looking forward, if you look at that amount, that actually between 60% and 70% of customers got some element of their money back, could be comforting, in a sense, but it doesn't take away from the fact that they were inherent risks around the business model, misleading, fraudulent activities around this case itself.
PL: It was lucky to hit though wasn't it for the customers? Because obviously you should read the terms and conditions, we don't all read those pages and Terms Conditions. So just depending on where they had actually invested within that organisation, maybe they got their money back, maybe they didn't, but the whole thing was just a lottery.
SK: Yeah, and I think it comes back to the fact that how important the terms and conditions are, and actually can't the general, vulnerable, customers, the retail customers, really understand what they're signing up for. And the interesting thing to note, certainly from my perspective, if you look on the other side, we were talking and focusing on the customers, but did the firm actually understand the risks it was taking and undertaking, when it was lending on to highly leveraged products? Yes, the customers did not understand the terms and conditions and products they were entering into or how their assets and money was being safeguarded. But equally, did the firm appreciate the level of risk it was entering in when lending on those products? And then I guess it comes back to something that we will probably touch on later, to do with the governance and risk management of the firm itself.
PL: Absolutely. Polly, Celsius was operating this particularly grey regulatory area around asset custody, which is the nub of all this, but this is why it triggered this bigger response from regulators right?
PT: Indeed, and feeding off what Shermeen said, Celsius, just like SBB, just like FTX, 'the downfall had nothing to do with crypto', is a classic failure in risk management and governance. Risk management, let's talk about it. We already mentioned that they were aggressively rehypothecating customers, assets. In fact, the first custodian they were working with parted ways with Celsius, precisely because of that, because they said the business model is not going to stand volatility in the markets. And so they stepped away. So it was a known thing. There was massive concentration risk because they were chasing the yields. So they were heavily invested in all their crypto products, so that part could have managed. That is classic asset and liability management on the governance side of things, given how many customers they had, they had three full-time compliance people for 1.7 million customers! But more to that, there have been allegations that they didn't do effective KYC and due diligence on senior leadership. They had an incoming CFO where the executives apparently told them, do not do KYC on this person, and this person was later implicated in money laundering in a previous company that they had worked for! And also, there are allegations that executives were manipulating the price of the sell token, which is the token produced by Celsius themselves. So all in all, this was just classic mismanagement of risk.
PL: And there were other red flags, weren't they? Because I believe several US states, they issued cease and desists, didn't they? In advance of the collapse?
PT: Indeed. And there's a question as to whether there were signs before the crash, because what happened was Celsius actually took out a Covid loan, the US equivalent of Covid loan, because during the Covid years, they were struggling, and they fulfilled the conditions to have that debt forgiven. IE, they probably weren't performing as well as they said. So there were some signs before the crash.
PL: As you say, it's an old fashioned tale, but the implications are here for crypto regulations. So what has happened on that since it's feeling like it's been a bit piecemeal?
PT: Well, certainly in America and I would be interested in Jessica and Sherween's thoughts. It feels very piecemeal because Celsius wasn't the first one and in the two weeks prior to that, there were two high profile bankruptcies already, Voyager Digital and three arrows capital, they were both crypto lenders as well. But it feels very much America taking a regulate buy bankruptcy court ruling (laughs). I mean, Jessica, what do you think?
JC: I mean, if we look at the regulation around crypto assets, up until this point where we have our crypto roadmap in progress, I would say globally, crypto products were in a bit of a grey area. In the UK, there was a mere requirement to register with the FCA for anti money laundering purposes. And there were also rules brought in in 2023 around marketing crypto products, to make sure that any sort of promotions of these were clear, fair and not misleading. So, you know, that sort of dealt with, I would say, these sort of wild statements being made on social media. But the framework was pretty light touch, even in the UK.
PL: And what's the FCA proposing now?
JC: As I said, we're sort of at the beginning of this crypto road map, but I think it's quite an interesting point to note that the Treasury has sort of shied away from regulating crypto because it said it didn't want to regulate things that didn't have the qualities of securities. And I think, you know, the SEC was saying that the earned product in particular definitely had these sort of security like qualities, and maybe that's been some sort of the impetus to regulate a bit more if we're seeing digital assets being used more, as, you know, investment type products rather than sort of a payments device. But what is the FCA proposing now? There's lots, lots of stuff coming out of the FCA.
PL: I mean, on crypto custody, they want to segregate, don't they?
JC: Yeah, yeah, absolutely. I think just for context, it's quite interesting to know that the Treasury has sort of been saying for a while that they felt that there was no sort of one size fits all approach to custody in the crypto world. The word sort of meant different things to different organisations, and there's definitely been a move to work out what that means across the industry. So yes, we have had some amendments to our framework legislation to bring the activities of cryptocurrency into our regulated activities order, we call it. And in terms of the FCA paper, they are proposing things like segregation, trust status, record keeping requirements, reconciliation, and these are all the hallmarks of our traditional customer assets regime.
PL: So that would have resolved at least some of the issues with Celsius, because the assets would have been held on behalf of clients in a trust.
JC: When I was talking about these unsecured claims in Earn, instead they would have been segregated and held sort of separately, and that would mean a better return on insolvency in the UK. So definitely, a better situation is being proposed.
PL: Which is presumably what Celsius customers thought was happening in the first place?
JC: Yeah, for sure.
SK: And just just to add to point that Jess made about the proposed regime: now CAS, the client asset regime, is a pretty stable and mature regime in the UK, and what the FCA is looking to do is you using that as a base with the same underlying principles of segregation, identification, reconciliation, and apply those, be it to a different asset class, and therefore that gives a lot of comfort to the market, and it's all about getting that confidence back and the trust back. So you use a stable regime such as client assets and use the similar principles and apply it to the proposed regime for the custody of the regulated stable coins and the regulated digital asset. I think that's a pretty promising place to be in at the moment.
PL: And the Bank of England, as I understand it, is also proposing temporary holding limits?
SK: Yes. So the Bank of England is looking to regulate the systemic stable coins. So whilst the FC is looking at regulating the stable coins in terms of more the conduct and the consumer protection, what the Bank of England is looking to do is really looking at the risk management and prudential requirements across the systemic stable coins, ie, to promote that in terms of the payment change. And when you talk about the limits that's really in terms of an initial phase and the first phase, while the market matures and it embeds, because the last thing we want to do is really destabilise the traditional finance market and model by introducing something that is not embedded into the system. So those holding limits are really there for an initial provisional phase, whilst the market matures, and these stable coins embed within to the market system.
PL: So slowing the pace of travel a bit.
PT: There's a lot of controversy over those limits, because a lot of people say it's unenforceable, because one exchange can only see what they have. It's very difficult to police like, "oh, this person is only holding X amount of crypto across all exchanges." How do you police that? So the consultation is ongoing at the moment, but here's a lot of controversy around those limits.
PL: There's a US/UK Task Force, isn't there?
PT: There is a US/UK Task Force. And actually, it might be really useful to kind of do a quick comparison. So US are going forward for the genius clarity act, but they're taking a more, slightly more laissez faire approach under Trump. EU has Mika, which is quite... it's actually very comprehensive. I think it's quite a good thing? (laughs) Gold plated. Gold plated. UK, we're a bit slower. We're getting there. HMT has just approved of the crypto regulations. And actually, you know what? I agree – they're going to bring people who are doing: same risk, same rules. People who are in crypto doing what is currently being regulated by the FCA, will be brought into the perimeter. I think that's quite a pragmatic approach. But the US/UK Task Force is basically the US and UK working together to try to see how we can get growth, essentially. But one of the ideas is joint sandboxing, in terms of: in this area of digital assets, how can we both work together to kind of reap the rewards of crypto? How that will work realistically, I'm not sure, given that there are variances in our regulation at the moment, but that is the idea.
PL: So there have been a number of consultations in this area. ICAEW has responded, everyone else has responded. What did ICAEW want?
PT: The main thing that we want, the main thing that we said at the US/UK Task Force roundtable is: in order for mainstream adoption of digital assets, you can't trust regulation alone. You have to have the legal, the tax, the financial reporting, the assurance frameworks backing that in order to instil consumer confidence and market integrity, without that, you cannot have mainstream adoption. And that's the message that we have been trying to relay to all regulators and the government.
PL: Shermeen protection of the consumer is paramount here. We don't always hear a lot about consumers when we're talking about the future of crypto do we? So how will that be achieved? Because I know when Polly was on the podcast last time we talked about this, you know, crypto can be great for business in terms of speed of transactions, the whole frictionless element of it, but for customers it could end up being expensive. So where are customers in all this?
SK: Consumer protection is absolutely paramount, right? And it has to be. And the reason is because the consumers are dealing with an ecosystem which is slightly different. Some may call it complex, but the way I certainly like to see it is it's slightly different. And why is it different? Right? It's different because it's not similar to the usual traditional finance products and investments that we are used to. And with that difference comes different types of risks. Now let's touch on some of the risks, because actually understanding some of the risk is what may add or alleviate the nervousness in the consumers, and therefore impact on, you know, the level of protection and their risk appetite as well. Polly, you mentioned about the same risk, same rules approach, which is quite interesting, and that's certainly the angle that the regulator is sort of taking at the moment. But with that, we must remember we are talking about and dealing with a different asset class, with different risks, right? There are different risks around the volatility and speculation, therefore, again, all impacting on the consumer protection and confidence: what do I really hold? How secure is it? How stable is it? You talk about the fraud and financial crime risk, which is a big, big area, and it was prevalent in the Celsius case as well. It's prevalent in some of the other crypto crashes, and, you know, the fraudulent activities and therefore, how do customers gain confidence that the firms that they're investing and using and interacting with have got that risk covered, right? You talk about the lack of transparency in auditing, which is a big thing. And you know, even in the Celsius case, we are well aware that the signed and financial statements were not available, they were behind on those assurance fees. Now it could be debatable that should some of that have been up to the mark or timely, some of the issues may have surfaced, for example, some of the control issues. If there had been assurance around some of the risk management and financial numbers, maybe some of the issues around the liquidity and the risk management could have been brought to light. So I guess it you've got to look at the consumer protection in light of the underlying risks that these assets bring and how they impact the consumer confidence. So any regulation and any Auditing and Assurance frameworks and legal frameworks have to develop and evolve in a way to address those underlying risks which will ultimately add to the consumer protection.
PL: Because the other side of that is the insolvency regime, isn't it?
JC: Yeah, I was just going to sort of jump in there quickly and say that one area where I think there is some promise in the UK is that we have something called the consumer duty, which is one of these key regulatory initiatives. And, you know, I think in time, we will have obligations on digital asset firms to comply with the consumer duty when they have retail consumers, at the at the end of the chain.
PL: And what will that mean in practice for consumers?
JC: Well, one of the things it means, you know, there's sort of various elements of the consumer duty. But one of them is this point around consumer understanding. And for example, in terms and conditions, really making clear what is going on, how your assets are being held, things like that. So I think that's, you know, a potential positive in terms of retail consumers. And going back to insolvency... So this is not my area of expertise, but I've had to sort of chat to my colleagues about what is going on. And yeah, there's no sort of plan for a standalone, digital assets insolvency regime, but a bit like how you know we're plugging crypto assets into FISMA, the plan is to plug them into our sort of existing insolvency regime. And I believe that Parliament has confirmed that digital assets should be treated much the same way as like an ordinary sort of property asset, and then you have the same types of tools that you would have for another type of asset or insolvency.
PL: Ok, so what do you think about that? Is that the right way forward?
PT: I completely agree with Shermeen. There are quirks here with digital assets, right? Let me give you a really good example: traditional finance – you've got share certificates, you lose your share certificate, you go back to the Central Depository, "Hey, replace my certificate, please." Crypto: You have a private key. That's your ownership of asset. You lose that. That's gone. Poof, you're done. Yeah, we've all heard about that. You cannot get it back. And the other thing is, it's irreversible. In traditional finance, you've got clearing, if it never has been made, you can rescind, you can reverse it. Crypto, no such thing. We've got blockchain, but it's not reversible right now. Circle, one of the biggest stable coins, are looking at reversing transactions, but they haven't got there yet, as far as I know. So there are a few quirks and new risks that are introduced, right? So another thing is in terms of custodians, classically post financial crisis, custodians will segregate your assets. So this has been mentioned already, but with a crypto lender, a custodian will absolutely relend your assets out to create yield. So when that happens, you don't know what you actually own, what you own, what you legally own, what you think you're going to recover, might be three very different things.
PL: So given that, how can it fit neatly into the existing insolvency regime?
PT: I'm going to go back. We need the frameworks, we need the assurance frameworks, we need the financial reporting frameworks to support those regulations, because without somebody looking at it, a third party, I'm not sure how you would get there.
SK: The regulation is moving at a very fast pace, but ultimately, if we do not have the legal, the accounting, the financial reporting and assurance, regulations and frameworks move at the same pace, it will be very difficult, because it comes back to the question of consumer protection and market confidence. Without the right level and assurance points around the way these businesses will operate and interact with the customers, it's very difficult to build the market trust and confidence and just building on, you know, like Polly mentioned the insolvency point, we must realise that, yes, it's sort of different asset class, but you're also talking about a different technology. So when you talk about the insolvency and closing the books at a specific point in time, and looking at the books and records at that point in time, is there enough transparency in the ledgers and the blockchains to be able to pinpoint that? And again, going back to the title of ownership, right? There's a lot of concepts, such as on-chain, off-chain, hot and cold wallets.. Who actually owns the asset, and what do you actually hold? So there needs to be work done around these areas to see how they will be not only fit, but interpreted within the insolvency regimes as well.
PL: Listening to what you're all saying, I'm wondering, is there a danger that the pressure to achieve a regulatory regime is driving this a bit too fast, because there's a huge amount of grunt work to do at the front end of that before you can arrive at anything that's actually going to be fit for purpose?
JC: I think there's quite a rush to ensure we don't have, like Celsius UK version happening, which I do understand, but you know, that's at risk of trying to sort of fit the regulatory framework into the wrong approach. And I yeah, I think I completely agree. There's all this sort of techie stuff going on in the background that I do not pretend to understand. I'm just wary of the fact that, you know, that might not fit within our sort of traditional client assets regime in the UK. So yeah, there's definitely work to be done. I would say.
PL: Yeah, because you know the temptation to tick the box, job done, when actually you end up with a regulatory regime that's not fit for purpose. I mean, that really would damage confidence, wouldn't it?
SK: Yes, exactly. It's really promising to see the proposed rules – the client asset rules for the custody right? Which, in practice, should address some of and highlight some of the failings that we've been talking about in the Celsius case. But even for that to come into place and for the practitioners to provide assurance, we require the frameworks. We require the assurance frameworks. We require the auditing interpretations of, you know, the ownership piece and the valuation and accounting, so that all has to go hand in hand, and it pretty much has to advance at a pretty fast pace.
PL: Wrapping this up, Shermeen, I've been thinking about finance professionals dealing with this question right now, and especially those auditing digital assets right now. What's your best advice?
SK: I think the best advice is everybody needs to upskill, and that's including the firms from the perspective of risk management, monitoring, controls, environments. And it's not only the control environments, but actually also evidencing the controls. So putting in place the controls that are relevant to address the risks of these assets is important, but equally, the monitoring and evidencing of it is pretty important too, because that will go hand in hand into how the assurance will be achieved in those areas. And similarly, for the auditing professionals, it's about really understanding the underlying risks that come with auditing such businesses, as well as the interconnectivity within the different players in this crypto ecosystem. So it's almost having a step back and looking at the overall macro risks as well, as opposed to the individual firm risks.
PL: Other thoughts on this?
PT: I think, as an investor, if it's too good to be true, it probably is.
PL: Yes, the old line, isn't it? Jess?
JC: I think just for everyone to keep an eye on, the papers coming out of the FCA, the Bank of England, the Treasury, because things are moving very quickly. I think the FCA has targeted 2026, for implementation, and...
PL: That seems soon!
JC: Very soon (laughs).
PT: I think there is an advantage to second mover, which I think we are. But no, I completely agree. And for everyone to work together, okay, not be siloed, we really, really need to work together in order to make this work, in order to protect the consumer and for market integrity.
PL: So Polly, I'm guessing there's a lot more information about this on the side?
PT: Absolutely, we have a dedicated digital assets hub on the ICAEW website, where there's some help sheets around things you need to consider when auditing cryptocurrencies, how to potentially account for stable coins and other crypto assets. So absolutely, wealth of information there.
PL: And of course, a great place to keep across developments, because, as you say, there's a lot of developments.
PT: Indeed, indeed.
PL: Thank you very much. Everyone. Really, really helpful.
PT: Thank you so much for having us.
SK: Thank you.
JC: Thank you.
PL: That is it for this episode. Later this month on Behind The Numbers, we'll be looking at the C-suite. How do you get there? What are the best routes of entry for ambitious finance and accounting professionals who think they've got what it takes to lead? Remember to log this podcast as CPD on the ICAEW website. Check out the back catalogue, where you'll find over 100 episodes to browse through all eligible as CPD – why wouldn't you? Subscribe to the podcast on your favourite app and we will, of course, alert you for every new episode. Thanks for being with us.
